[Snort-users] Which so_rules to use

Joel Esler (jesler) jesler at ...589...
Wed May 24 12:29:28 EDT 2017

You should use pulledpork to manage your ruleset, it will take care of which version you need, according to the operating system you are using or the one you specify.

Joel Esler | Talos: Manager | jesler at ...589...<mailto:jesler at ...589...>

On May 24, 2017, at 9:14 AM, Charlie Dyer <charlierwdyer at ...11827...<mailto:charlierwdyer at ...11827...>> wrote:


I've compiled the so_rules from the src folder but see there are
precompiled so_rules with the same name, but some of them have vastly
different file sizes.  There are also precompiled .so files which aren't in
the src folder once compiled and vice versa.

Does anyone know which .so files to use?  For example there is a
file-flash.so in the precompiled folder and the src folder, which should I

Many thanks
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org<http://Slashdot.org>! http://sdm.link/slashdot
Snort-users mailing list
Snort-users at lists.sourceforge.net<mailto:Snort-users at lists.sourceforge.net>
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

Please visit http://blog.snort.org to stay current on all the latest Snort news!

More information about the Snort-users mailing list